Questions tagged [rpz]
Response Policy Zones are a form of DNS firewall that define policy actions within a DNS zone file.
25
questions
0
votes
0
answers
31
views
Sometimes, the Bind9 will return the recursive record after I configure the response policy zone
I configure a response policy zone in my DNS server and I use that to block two domains.
This is my zone file.
$TTL 1
$ORIGIN rpztest.
@ IN SOA ns1.fati. ns2.fati. (
...
0
votes
0
answers
233
views
Bind9 how to use RPZ zone for specific subnets
I already have 1 master(192.168.130.32) 4 slaves(192.168.130.35) and 2 authoritative(192.168.130.33) servers with bind9.
My point is to get RPZ(192.168.130.37) from external DNS servers, but I want to ...
-2
votes
2
answers
494
views
Block IP in DNS Zone File (Instead of Domain)
I'm using bind9 DNS server. I used to block websites using their domain name in RPZ zone file such as:
malicious.example CNAME .
But, I need to block IP rather than domain such as:
192.0.2.4 ...
0
votes
2
answers
567
views
How to set up whitelisting on a DNS forwarding server with BIND9?
I have set up a DNS forwarding server on Ubuntu 20.04 LTS using Bind 9. I need to implement DNS whitelisting, however, I have not found any tutorials which explain how to set it up. I have tried ...
0
votes
2
answers
1k
views
Bind9 Response Policy ignoring out-of-zone data
I'm trying to set up response policy on my existing Bind9 server because I'd like to override some of my company public domain to redirect them to our private network ips.
I've followed this tutorial :...
0
votes
1
answer
706
views
Overriding a .local Domain to a Public IP
I am using a BIND9 DNS server for my org, and I have an application that was published with a .local domain: example.website.local. There is an .com alternative that I want to re-map the .local to ...
1
vote
0
answers
291
views
Is there a way to block a specific query type on bind
I've been trying to find a way to block the WKS query type from our bind servers.
We have found that is is extensively used by tunneling software.
I tried using RPZ but i'm not sure on how to block a ...
3
votes
0
answers
326
views
How to block AAAA answers for certain domains using RPZ?
Is it possible to block AAAA answers being sent back to clients from a local dns server, but only for certain forward dns domains?
I know I can do the filtering based on ipv6 subnet (working sample ...
1
vote
0
answers
624
views
Why does BIND perform a double query before answering NXDOMAIN for a RPZ (response-policy zone)?
The goal is to have a local DNS server with the following specifics:
split DNS setup that resolves a FQDN (e.g. localdomain.com) to a local IP instead of the external IP
use a RPZ (response policy ...
0
votes
1
answer
1k
views
Log category RPZ to syslog in BIND 9
I am running a chrooted BIND 9.11 server on FreeBSD 11.2 that has a RPZ configured. It is currently logging RPZ hits in a file, but I would like to (also) send them to syslog.
I can see other log ...
0
votes
1
answer
1k
views
Wildcards in RPZ (response policy zones)
Is it possible to have wildcards domains in the middle of a domain name using response policy zones? For example s3.*.amazonaws.com.
If this is not possible, is there a technology, that can do this?
2
votes
2
answers
3k
views
'query_getzonedb()failed: Zone Not Loaded' error in DNS logs
While investigating an incident, I noticed an error in my syslog that looks like this (anonymized):
Feb 3 21:59:59 ns1 named[18824]: client xxx.xxx.xxx.xxx#2091 (us-east1-aws.api.snapchat.com): view ...
0
votes
2
answers
736
views
Get DNS 'Additional section' using Windows (nslookup option?)
I can use dig to get the full master file output of DNS info, and for my problem I am interested in the information in the "additional" section:
$ dig example.com
; <<>> DiG 9.9.4-RedHat-...
1
vote
0
answers
429
views
Why does my Bind RPZ config work for one host, but not the other (SERVFAIL)
I have some hosts in a DMZ which need to use LDAP resources on the LAN. We don't forward DNS into the LAN, so instead of adding entries in individual /etc/hosts, I decided to try a Bind RPZ zone to ...
3
votes
1
answer
1k
views
RPZ CNAME leaks usage of RPZ
For history reasons we have both internal (192.168.0.0/16) and public IPs on hosts on one domain (example.com). I now want to split this up so that internal hostnames are not resolved for external ...
2
votes
0
answers
506
views
BIND different forwarder based on response ip (rpz-ip)
I have a recursive BIND dns server .
forwarders {
8.8.8.8;
};
Is it possible to change the forwarder based on respone ip ?
For example if the response is 192.168.1.1 then forward/...
7
votes
1
answer
5k
views
BIND, RPZ and Forwarding priorities
My objective is to block certain domains in bind WITHOUT first looking up their address (this is a small caching bind dns server).
Currently my configuration will forward the request for badhost.com ...
1
vote
1
answer
1k
views
serve the root zone with bind and utilize RPZ
I have some problems with configuring BIND as my private server at root zone.
I have tried the dot "." (had read somewhere) and an empty string "" (my bad guess) as for the root zone identifier (...
4
votes
1
answer
1k
views
Alternative ways to get past 32 rpz zone limit in BIND? ...without running BIND a thousand times
Using BIND RPZs gives me exactly what I'm looking for to alter queries. However, my recursive DNS server is in use by hundreds of clients and I am looking for a way to allow each client some level of ...
0
votes
2
answers
10k
views
With BIND 9 how can I match-clients in multiple views?
BIND appears to be looking at the configuration file from top-down and assigning queries to the first matching view based on match-clients. According to http://www.zytrax.com/books/dns/ch7/view.html ...
1
vote
1
answer
1k
views
Certificate Errors on "redirection" in DNS RPZ of https/ssl
I've set up a DNS RPZ where I "redirect" users to a walled garden using DNS RPZ records when users try to access a list of bad sites.
Let's say a user tries to access badsite.com. The redirection to ...
7
votes
1
answer
8k
views
Set up BIND9 as DNS Firewall
With OpenDNS now needing one to be on the pro package to have filtering turned on, being on a tight budget, we are in need of free DNS filtering.
After reading this link on how to block domains with ...
0
votes
1
answer
2k
views
Why does nslookup not return what I am expecting from my bind server? (RPZ configured)
Prior to this question I was looking for some help in finding a way to return a different response to querying clients based on their IP Address. The question was answered here: How can I selectively ...
2
votes
2
answers
269
views
Can DNS RPZ firewalls protect against IP Access?
I am looking into DNS-RPZ firewalls.
Can they protect against users browsing to http://{ip-address}?
If so how does that work? Given no name resolution is required?
2
votes
1
answer
385
views
How to automatically rewrite response records obtained using recursion in BIND?
I'm using Bind 9.9.4 on a hypervisor (lets call the hypervisor A) for VMs. The hypervisor has a VPN connection to a different host (lets call it B), which also has a public IP. The bind on hypervisor ...